This is the second in our series of client alerts on the Amended P2SK Law (Law No. 4 of 2026, amending Law No. 4 of 2023 on Financial Sector Development and Strengthening, enacted on 17 June 2026). Our first alert (click here to read) mapped the overall shape of the reforms. This alert looks specifically at what changes for consumer protection and how some of them may have practical implications for financial sector business actors (Pelaku Usaha Sektor Keuangan or "PUSK"), including financial institutions, fintech companies, and crypto asset businesses operating in or serving consumers in Indonesia.

While the core consumer protection framework remains largely unchanged, four developments stand out for their effect on governance, compliance, enforcement exposure, and regulatory oversight.

Key Changes to the Consumer Protection Framework

1. Consumer protection framework now expressly applies to crypto assets

   One of the Amended P2SK Law's key reforms is bringing crypto assets formally within Indonesia's financial sector regulatory framework.

   As a result, consumer protection provisions that previously applied to other financial sector activities now also apply to crypto asset financial services. This includes crypto asset traders, crypto asset exchanges, crypto clearing and settlement institutions, centralised crypto custodians, and other entities designated by the Financial Services Authority (Otoritas Jasa Keuangan or "OJK").

   Businesses operating in the crypto asset ecosystem should therefore review whether their policies and procedures on consumer rights, disclosures, complaint handling, and prohibited conduct already meet the standards generally applicable to financial sector businesses.

   It is also important to note that the definition of "consumer" under the P2SK Law framework differs from the definition under the general consumer protection law (Law 8/1999). Under Article 1 (42), a consumer includes any person who owns and/or uses financial products and/or services, which may encompass not only end users but also business entities or intermediate consumers.

   In addition, OJK's supervisory powers over crypto and digital asset financial services institutions ("Crypto and Digital Asset Institutions") have been expanded. OJK is now authorised, in coordination with relevant ministries and government agencies, to suspend and/or block crypto asset transactions and trading activities that do not comply with applicable laws and regulations, including activities conducted by foreign parties.

2. Liability of Crypto and Digital Asset Institutions expanded, includes for misconduct by third parties and controlling parties

   The Amended P2SK Law clarifies the responsibility of Crypto and Digital Asset Institutions for consumer losses arising from errors, negligence, or violations of financial sector regulations committed by their management, third parties acting on their behalf or for their benefit, as well as their controlling parties or shareholders.

   This extends liability beyond management and third parties acting on the institution's behalf to reach controlling parties and shareholders directly, which is a broader statutory basis for consumer-loss liability than previously existed in this sector. Businesses should review their governance arrangements, outsourcing structures, shareholder-control mechanisms, and customer compensation frameworks against this expanded exposure.

3. Cross-sectoral task force's mandate expanded to cover consumer protection

   The Amended P2SK Law expands the mandate of the cross-sectoral task force established under the original P2SK Law, which now expressly covers consumer protection.

   The task force's mandate includes preventing and addressing unauthorised financial business activities, as well as tackling misconduct by licensed financial sector businesses, including violations of debt collection requirements, misuse of consumer data, and breaches of consumer protection rules.

   This development may increase enforcement exposure for licensed businesses beyond the obvious case of unauthorised activity. Day-to-day consumer-facing practices, such as debt collection, data handling, complaint handling, and marketing conduct, can now also draw the task force's scrutiny if viewed as inconsistent with consumer protection requirements.

   The task force comprises the OJK, the Financial Transaction Reports and Analysis Center (Pusat Pelaporan dan Analisis Keuangan or PPATK), relevant ministries and government agencies, and law enforcement authorities.

4. Restorative justice framework introduced for financial sector offences

   In addition to strengthening consumer protection enforcement, the Amended P2SK Law introduces the possibility of resolving certain criminal offences in the financial sector through a restorative justice mechanism, as recognised under Law No. 20 of 2025 on Criminal Procedural Law ("Criminal Procedural Law"). As the Amended P2SK Law is the specialised law governing the financial sector, the restorative justice process will generally follow the framework under the Criminal Procedural Law, except where the Amended P2SK Law provides otherwise.

   Under this mechanism, victims and offenders may reach an amicable settlement that includes compensation to the victim. The mechanism may be pursued at the investigation, prosecution, or trial stage and is generally available for first-time offenders and non-recidivist offences.

   This development may provide an additional avenue for resolving financial sector offences in a manner that is more focused on victim recovery. Nevertheless, its practical implementation remains subject to further guidance, as the Amended P2SK Law requires the issuance of a Government Regulation setting out the applicable procedures. As of the date of this client alert, no such implementing regulation has been issued.

Maintained Core Framework

Despite the developments discussed above, the overall consumer protection framework under the financial sector regulatory regime remains largely unchanged. The Amended P2SK Law does not introduce a new consumer protection regime.

The law continues to provide the primary consumer protection framework applicable to PUSKs and other businesses operating in the financial sector. It also maintains the existing obligations applicable throughout the lifecycle of financial products and services, including product design, disclosures, marketing and distribution activities, the provision of financial products and services, and complaint handling.

These obligations continue to include requirements relating to consumer rights, PUSK obligations, prohibited conduct and standard clauses, consumer data protection, and dispute resolution mechanisms. Any violation of these rules is subject to administrative and/or criminal penalties.

Looking Ahead

In an increasingly complex regulatory environment, PUSKs and other financial sector businesses are required not only to comply with formal obligations, such as reporting requirements and standard procedures, but also to actively manage risks where an incorrect decision may have significant commercial, financial, operational, and reputational consequences.

Consumer protection compliance should therefore not be treated merely as a documentation exercise. Businesses should assess whether their product design, disclosures, sales practices, complaint handling procedures, data governance practices, and third-party arrangements operate effectively in practice. This is particularly relevant for crypto asset and digital financial asset businesses, where regulatory expectations, enforcement tools, and customer-risk profiles continue to evolve.

Businesses should also recognise that current decisions may affect future regulatory risks, enforcement exposure, transaction certainty, and commercial flexibility.

In light of the above developments, the following actions should be considered:

• Crypto and Digital Asset Institutions should assess governance arrangements, data handling practices, and consumer-loss allocation mechanisms in light of both the expanded consumer protection scope and the new controlling-party liability exposure.

• All PUSKs should review consumer-facing disclosures, marketing materials, and complaint-handling procedures against the task force's expanded mandate, which now reaches day-to-day consumer-facing conduct and not just licensing status.

• Businesses should review standard-form agreements and limitation-of-liability provisions in view of the broader statutory basis for consumer-loss liability.

• Businesses relying on outsourcing or other third-party arrangements should confirm these remain consistent with the expanded liability framework for third-party and controlling-party conduct.‌